Azure Key Vault Key Modified or Deleted via Activity Log Operations

Alerts on Azure Key Vault key create/update/import/recover/restore/backup/purge/delete activity from Activity Logs.

FreeReviewedSigma · Medium · v5

Product: azure
Service: activitylogs
Author: Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published: 2021-08-16
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552Unsecured Credentials
- T1552.001Credentials In Files
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Azure Key Vault key lifecycle events where a key is created, updated, imported, recovered, restored, backed up, deleted, or purged. Attackers may alter or remove keys to enable unauthorized access, deny service, or disrupt protected workloads, making these changes high-signal for credential access and impact. It relies on Azure Activity Log event entries matching specific MICROSOFT.KEYVAULT/VAULTS/KEYS operationName values.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange

Azure Key Vault Modified or Deleted via Activity Log Operations

Azure Key Vault secret modified or deleted activity

Suspicious TruffleHog Execution Spawned by Bun Runtime via Process Creation

Malicious AWS Credential Exfiltration via Curl or Wget in Process Creation

Suspicious sqlite3 Access to gcloud Cached Access Token Database (via process_creation)

Suspicious AWS GetCallerIdentity From TruffleHog User Agent via Cloudtrail

Suspicious AWS API Call from TruffleHog Credential Scanner User Agent

Suspicious GitHub CLI Auth Token Extraction via Command Line

Suspicious Access to macOS Login Keychain by Slow Pisces (via process_creation)

Azure Key Vault Key Modified or Deleted via Activity Log Operations

Pivot detection · T1552.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

azure-key-vault-key-modified-or-deleted-via-activity-log-80eeab92

title: Azure Key Vault Key Modified or Deleted via Activity Log Operations
id: 50890364-4ffb-4f34-866b-6fc32c81d15c
status: test
description: This rule identifies Azure Key Vault key lifecycle events where a key is created, updated, imported, recovered, restored, backed up, deleted, or purged. Attackers may alter or remove keys to enable unauthorized access, deny service, or disrupt protected workloads, making these changes high-signal for credential access and impact. It relies on Azure Activity Log event entries matching specific MICROSOFT.KEYVAULT/VAULTS/KEYS operationName values.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_keyvault_key_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-16
modified: 2022-08-23
tags:
  - attack.impact
  - attack.credential-access
  - attack.t1552
  - attack.t1552.001
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName:
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/UPDATE/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/IMPORT/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/RECOVER/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/RESTORE/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/DELETE
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/BACKUP/ACTION
      - MICROSOFT.KEYVAULT/VAULTS/KEYS/PURGE/ACTION
  condition: selection
falsepositives:
  - Key being modified or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Key modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 80eeab92-0979-4152-942d-96749e11df40
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL